xref: /qemu/hw/usb/dev-storage.c (revision db1015e92e04835c9eb50c29625fe566d1202dbd)
1 /*
2  * USB Mass Storage Device emulation
3  *
4  * Copyright (c) 2006 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the LGPL.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qapi/error.h"
12 #include "qemu/error-report.h"
13 #include "qemu/module.h"
14 #include "qemu/option.h"
15 #include "qemu/config-file.h"
16 #include "hw/usb.h"
17 #include "desc.h"
18 #include "hw/qdev-properties.h"
19 #include "hw/scsi/scsi.h"
20 #include "migration/vmstate.h"
21 #include "sysemu/sysemu.h"
22 #include "sysemu/block-backend.h"
23 #include "qapi/visitor.h"
24 #include "qemu/cutils.h"
25 #include "qom/object.h"
26 
27 //#define DEBUG_MSD
28 
29 #ifdef DEBUG_MSD
30 #define DPRINTF(fmt, ...) \
31 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
32 #else
33 #define DPRINTF(fmt, ...) do {} while(0)
34 #endif
35 
36 /* USB requests.  */
37 #define MassStorageReset  0xff
38 #define GetMaxLun         0xfe
39 
40 enum USBMSDMode {
41     USB_MSDM_CBW, /* Command Block.  */
42     USB_MSDM_DATAOUT, /* Transfer data to device.  */
43     USB_MSDM_DATAIN, /* Transfer data from device.  */
44     USB_MSDM_CSW /* Command Status.  */
45 };
46 
47 struct usb_msd_csw {
48     uint32_t sig;
49     uint32_t tag;
50     uint32_t residue;
51     uint8_t status;
52 };
53 
54 struct MSDState {
55     USBDevice dev;
56     enum USBMSDMode mode;
57     uint32_t scsi_off;
58     uint32_t scsi_len;
59     uint32_t data_len;
60     struct usb_msd_csw csw;
61     SCSIRequest *req;
62     SCSIBus bus;
63     /* For async completion.  */
64     USBPacket *packet;
65     /* usb-storage only */
66     BlockConf conf;
67     uint32_t removable;
68     SCSIDevice *scsi_dev;
69 };
70 typedef struct MSDState MSDState;
71 
72 #define TYPE_USB_STORAGE "usb-storage-dev"
73 #define USB_STORAGE_DEV(obj) OBJECT_CHECK(MSDState, (obj), TYPE_USB_STORAGE)
74 
75 struct usb_msd_cbw {
76     uint32_t sig;
77     uint32_t tag;
78     uint32_t data_len;
79     uint8_t flags;
80     uint8_t lun;
81     uint8_t cmd_len;
82     uint8_t cmd[16];
83 };
84 
85 enum {
86     STR_MANUFACTURER = 1,
87     STR_PRODUCT,
88     STR_SERIALNUMBER,
89     STR_CONFIG_FULL,
90     STR_CONFIG_HIGH,
91     STR_CONFIG_SUPER,
92 };
93 
94 static const USBDescStrings desc_strings = {
95     [STR_MANUFACTURER] = "QEMU",
96     [STR_PRODUCT]      = "QEMU USB HARDDRIVE",
97     [STR_SERIALNUMBER] = "1",
98     [STR_CONFIG_FULL]  = "Full speed config (usb 1.1)",
99     [STR_CONFIG_HIGH]  = "High speed config (usb 2.0)",
100     [STR_CONFIG_SUPER] = "Super speed config (usb 3.0)",
101 };
102 
103 static const USBDescIface desc_iface_full = {
104     .bInterfaceNumber              = 0,
105     .bNumEndpoints                 = 2,
106     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
107     .bInterfaceSubClass            = 0x06, /* SCSI */
108     .bInterfaceProtocol            = 0x50, /* Bulk */
109     .eps = (USBDescEndpoint[]) {
110         {
111             .bEndpointAddress      = USB_DIR_IN | 0x01,
112             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
113             .wMaxPacketSize        = 64,
114         },{
115             .bEndpointAddress      = USB_DIR_OUT | 0x02,
116             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
117             .wMaxPacketSize        = 64,
118         },
119     }
120 };
121 
122 static const USBDescDevice desc_device_full = {
123     .bcdUSB                        = 0x0200,
124     .bMaxPacketSize0               = 8,
125     .bNumConfigurations            = 1,
126     .confs = (USBDescConfig[]) {
127         {
128             .bNumInterfaces        = 1,
129             .bConfigurationValue   = 1,
130             .iConfiguration        = STR_CONFIG_FULL,
131             .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
132             .nif = 1,
133             .ifs = &desc_iface_full,
134         },
135     },
136 };
137 
138 static const USBDescIface desc_iface_high = {
139     .bInterfaceNumber              = 0,
140     .bNumEndpoints                 = 2,
141     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
142     .bInterfaceSubClass            = 0x06, /* SCSI */
143     .bInterfaceProtocol            = 0x50, /* Bulk */
144     .eps = (USBDescEndpoint[]) {
145         {
146             .bEndpointAddress      = USB_DIR_IN | 0x01,
147             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
148             .wMaxPacketSize        = 512,
149         },{
150             .bEndpointAddress      = USB_DIR_OUT | 0x02,
151             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
152             .wMaxPacketSize        = 512,
153         },
154     }
155 };
156 
157 static const USBDescDevice desc_device_high = {
158     .bcdUSB                        = 0x0200,
159     .bMaxPacketSize0               = 64,
160     .bNumConfigurations            = 1,
161     .confs = (USBDescConfig[]) {
162         {
163             .bNumInterfaces        = 1,
164             .bConfigurationValue   = 1,
165             .iConfiguration        = STR_CONFIG_HIGH,
166             .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
167             .nif = 1,
168             .ifs = &desc_iface_high,
169         },
170     },
171 };
172 
173 static const USBDescIface desc_iface_super = {
174     .bInterfaceNumber              = 0,
175     .bNumEndpoints                 = 2,
176     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
177     .bInterfaceSubClass            = 0x06, /* SCSI */
178     .bInterfaceProtocol            = 0x50, /* Bulk */
179     .eps = (USBDescEndpoint[]) {
180         {
181             .bEndpointAddress      = USB_DIR_IN | 0x01,
182             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
183             .wMaxPacketSize        = 1024,
184             .bMaxBurst             = 15,
185         },{
186             .bEndpointAddress      = USB_DIR_OUT | 0x02,
187             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
188             .wMaxPacketSize        = 1024,
189             .bMaxBurst             = 15,
190         },
191     }
192 };
193 
194 static const USBDescDevice desc_device_super = {
195     .bcdUSB                        = 0x0300,
196     .bMaxPacketSize0               = 9,
197     .bNumConfigurations            = 1,
198     .confs = (USBDescConfig[]) {
199         {
200             .bNumInterfaces        = 1,
201             .bConfigurationValue   = 1,
202             .iConfiguration        = STR_CONFIG_SUPER,
203             .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
204             .nif = 1,
205             .ifs = &desc_iface_super,
206         },
207     },
208 };
209 
210 static const USBDesc desc = {
211     .id = {
212         .idVendor          = 0x46f4, /* CRC16() of "QEMU" */
213         .idProduct         = 0x0001,
214         .bcdDevice         = 0,
215         .iManufacturer     = STR_MANUFACTURER,
216         .iProduct          = STR_PRODUCT,
217         .iSerialNumber     = STR_SERIALNUMBER,
218     },
219     .full  = &desc_device_full,
220     .high  = &desc_device_high,
221     .super = &desc_device_super,
222     .str   = desc_strings,
223 };
224 
225 static void usb_msd_copy_data(MSDState *s, USBPacket *p)
226 {
227     uint32_t len;
228     len = p->iov.size - p->actual_length;
229     if (len > s->scsi_len)
230         len = s->scsi_len;
231     usb_packet_copy(p, scsi_req_get_buf(s->req) + s->scsi_off, len);
232     s->scsi_len -= len;
233     s->scsi_off += len;
234     if (len > s->data_len) {
235         len = s->data_len;
236     }
237     s->data_len -= len;
238     if (s->scsi_len == 0 || s->data_len == 0) {
239         scsi_req_continue(s->req);
240     }
241 }
242 
243 static void usb_msd_send_status(MSDState *s, USBPacket *p)
244 {
245     int len;
246 
247     DPRINTF("Command status %d tag 0x%x, len %zd\n",
248             s->csw.status, le32_to_cpu(s->csw.tag), p->iov.size);
249 
250     assert(s->csw.sig == cpu_to_le32(0x53425355));
251     len = MIN(sizeof(s->csw), p->iov.size);
252     usb_packet_copy(p, &s->csw, len);
253     memset(&s->csw, 0, sizeof(s->csw));
254 }
255 
256 static void usb_msd_packet_complete(MSDState *s)
257 {
258     USBPacket *p = s->packet;
259 
260     /* Set s->packet to NULL before calling usb_packet_complete
261        because another request may be issued before
262        usb_packet_complete returns.  */
263     DPRINTF("Packet complete %p\n", p);
264     s->packet = NULL;
265     usb_packet_complete(&s->dev, p);
266 }
267 
268 static void usb_msd_transfer_data(SCSIRequest *req, uint32_t len)
269 {
270     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
271     USBPacket *p = s->packet;
272 
273     assert((s->mode == USB_MSDM_DATAOUT) == (req->cmd.mode == SCSI_XFER_TO_DEV));
274     s->scsi_len = len;
275     s->scsi_off = 0;
276     if (p) {
277         usb_msd_copy_data(s, p);
278         p = s->packet;
279         if (p && p->actual_length == p->iov.size) {
280             p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
281             usb_msd_packet_complete(s);
282         }
283     }
284 }
285 
286 static void usb_msd_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
287 {
288     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
289     USBPacket *p = s->packet;
290 
291     DPRINTF("Command complete %d tag 0x%x\n", status, req->tag);
292 
293     s->csw.sig = cpu_to_le32(0x53425355);
294     s->csw.tag = cpu_to_le32(req->tag);
295     s->csw.residue = cpu_to_le32(s->data_len);
296     s->csw.status = status != 0;
297 
298     if (s->packet) {
299         if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
300             /* A deferred packet with no write data remaining must be
301                the status read packet.  */
302             usb_msd_send_status(s, p);
303             s->mode = USB_MSDM_CBW;
304         } else if (s->mode == USB_MSDM_CSW) {
305             usb_msd_send_status(s, p);
306             s->mode = USB_MSDM_CBW;
307         } else {
308             if (s->data_len) {
309                 int len = (p->iov.size - p->actual_length);
310                 usb_packet_skip(p, len);
311                 if (len > s->data_len) {
312                     len = s->data_len;
313                 }
314                 s->data_len -= len;
315             }
316             if (s->data_len == 0) {
317                 s->mode = USB_MSDM_CSW;
318             }
319         }
320         p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
321         usb_msd_packet_complete(s);
322     } else if (s->data_len == 0) {
323         s->mode = USB_MSDM_CSW;
324     }
325     scsi_req_unref(req);
326     s->req = NULL;
327 }
328 
329 static void usb_msd_request_cancelled(SCSIRequest *req)
330 {
331     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
332 
333     if (req == s->req) {
334         scsi_req_unref(s->req);
335         s->req = NULL;
336         s->scsi_len = 0;
337     }
338 }
339 
340 static void usb_msd_handle_reset(USBDevice *dev)
341 {
342     MSDState *s = (MSDState *)dev;
343 
344     DPRINTF("Reset\n");
345     if (s->req) {
346         scsi_req_cancel(s->req);
347     }
348     assert(s->req == NULL);
349 
350     if (s->packet) {
351         s->packet->status = USB_RET_STALL;
352         usb_msd_packet_complete(s);
353     }
354 
355     s->mode = USB_MSDM_CBW;
356 }
357 
358 static void usb_msd_handle_control(USBDevice *dev, USBPacket *p,
359                int request, int value, int index, int length, uint8_t *data)
360 {
361     MSDState *s = (MSDState *)dev;
362     SCSIDevice *scsi_dev;
363     int ret, maxlun;
364 
365     ret = usb_desc_handle_control(dev, p, request, value, index, length, data);
366     if (ret >= 0) {
367         return;
368     }
369 
370     switch (request) {
371     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
372         break;
373         /* Class specific requests.  */
374     case ClassInterfaceOutRequest | MassStorageReset:
375         /* Reset state ready for the next CBW.  */
376         s->mode = USB_MSDM_CBW;
377         break;
378     case ClassInterfaceRequest | GetMaxLun:
379         maxlun = 0;
380         for (;;) {
381             scsi_dev = scsi_device_find(&s->bus, 0, 0, maxlun+1);
382             if (scsi_dev == NULL) {
383                 break;
384             }
385             if (scsi_dev->lun != maxlun+1) {
386                 break;
387             }
388             maxlun++;
389         }
390         DPRINTF("MaxLun %d\n", maxlun);
391         data[0] = maxlun;
392         p->actual_length = 1;
393         break;
394     default:
395         p->status = USB_RET_STALL;
396         break;
397     }
398 }
399 
400 static void usb_msd_cancel_io(USBDevice *dev, USBPacket *p)
401 {
402     MSDState *s = USB_STORAGE_DEV(dev);
403 
404     assert(s->packet == p);
405     s->packet = NULL;
406 
407     if (s->req) {
408         scsi_req_cancel(s->req);
409     }
410 }
411 
412 static void usb_msd_handle_data(USBDevice *dev, USBPacket *p)
413 {
414     MSDState *s = (MSDState *)dev;
415     uint32_t tag;
416     struct usb_msd_cbw cbw;
417     uint8_t devep = p->ep->nr;
418     SCSIDevice *scsi_dev;
419     uint32_t len;
420 
421     switch (p->pid) {
422     case USB_TOKEN_OUT:
423         if (devep != 2)
424             goto fail;
425 
426         switch (s->mode) {
427         case USB_MSDM_CBW:
428             if (p->iov.size != 31) {
429                 error_report("usb-msd: Bad CBW size");
430                 goto fail;
431             }
432             usb_packet_copy(p, &cbw, 31);
433             if (le32_to_cpu(cbw.sig) != 0x43425355) {
434                 error_report("usb-msd: Bad signature %08x",
435                              le32_to_cpu(cbw.sig));
436                 goto fail;
437             }
438             DPRINTF("Command on LUN %d\n", cbw.lun);
439             scsi_dev = scsi_device_find(&s->bus, 0, 0, cbw.lun);
440             if (scsi_dev == NULL) {
441                 error_report("usb-msd: Bad LUN %d", cbw.lun);
442                 goto fail;
443             }
444             tag = le32_to_cpu(cbw.tag);
445             s->data_len = le32_to_cpu(cbw.data_len);
446             if (s->data_len == 0) {
447                 s->mode = USB_MSDM_CSW;
448             } else if (cbw.flags & 0x80) {
449                 s->mode = USB_MSDM_DATAIN;
450             } else {
451                 s->mode = USB_MSDM_DATAOUT;
452             }
453             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
454                     tag, cbw.flags, cbw.cmd_len, s->data_len);
455             assert(le32_to_cpu(s->csw.residue) == 0);
456             s->scsi_len = 0;
457             s->req = scsi_req_new(scsi_dev, tag, cbw.lun, cbw.cmd, NULL);
458 #ifdef DEBUG_MSD
459             scsi_req_print(s->req);
460 #endif
461             len = scsi_req_enqueue(s->req);
462             if (len) {
463                 scsi_req_continue(s->req);
464             }
465             break;
466 
467         case USB_MSDM_DATAOUT:
468             DPRINTF("Data out %zd/%d\n", p->iov.size, s->data_len);
469             if (p->iov.size > s->data_len) {
470                 goto fail;
471             }
472 
473             if (s->scsi_len) {
474                 usb_msd_copy_data(s, p);
475             }
476             if (le32_to_cpu(s->csw.residue)) {
477                 int len = p->iov.size - p->actual_length;
478                 if (len) {
479                     usb_packet_skip(p, len);
480                     if (len > s->data_len) {
481                         len = s->data_len;
482                     }
483                     s->data_len -= len;
484                     if (s->data_len == 0) {
485                         s->mode = USB_MSDM_CSW;
486                     }
487                 }
488             }
489             if (p->actual_length < p->iov.size) {
490                 DPRINTF("Deferring packet %p [wait data-out]\n", p);
491                 s->packet = p;
492                 p->status = USB_RET_ASYNC;
493             }
494             break;
495 
496         default:
497             DPRINTF("Unexpected write (len %zd)\n", p->iov.size);
498             goto fail;
499         }
500         break;
501 
502     case USB_TOKEN_IN:
503         if (devep != 1)
504             goto fail;
505 
506         switch (s->mode) {
507         case USB_MSDM_DATAOUT:
508             if (s->data_len != 0 || p->iov.size < 13) {
509                 goto fail;
510             }
511             /* Waiting for SCSI write to complete.  */
512             s->packet = p;
513             p->status = USB_RET_ASYNC;
514             break;
515 
516         case USB_MSDM_CSW:
517             if (p->iov.size < 13) {
518                 goto fail;
519             }
520 
521             if (s->req) {
522                 /* still in flight */
523                 DPRINTF("Deferring packet %p [wait status]\n", p);
524                 s->packet = p;
525                 p->status = USB_RET_ASYNC;
526             } else {
527                 usb_msd_send_status(s, p);
528                 s->mode = USB_MSDM_CBW;
529             }
530             break;
531 
532         case USB_MSDM_DATAIN:
533             DPRINTF("Data in %zd/%d, scsi_len %d\n",
534                     p->iov.size, s->data_len, s->scsi_len);
535             if (s->scsi_len) {
536                 usb_msd_copy_data(s, p);
537             }
538             if (le32_to_cpu(s->csw.residue)) {
539                 int len = p->iov.size - p->actual_length;
540                 if (len) {
541                     usb_packet_skip(p, len);
542                     if (len > s->data_len) {
543                         len = s->data_len;
544                     }
545                     s->data_len -= len;
546                     if (s->data_len == 0) {
547                         s->mode = USB_MSDM_CSW;
548                     }
549                 }
550             }
551             if (p->actual_length < p->iov.size && s->mode == USB_MSDM_DATAIN) {
552                 DPRINTF("Deferring packet %p [wait data-in]\n", p);
553                 s->packet = p;
554                 p->status = USB_RET_ASYNC;
555             }
556             break;
557 
558         default:
559             DPRINTF("Unexpected read (len %zd)\n", p->iov.size);
560             goto fail;
561         }
562         break;
563 
564     default:
565         DPRINTF("Bad token\n");
566     fail:
567         p->status = USB_RET_STALL;
568         break;
569     }
570 }
571 
572 static void *usb_msd_load_request(QEMUFile *f, SCSIRequest *req)
573 {
574     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
575 
576     /* nothing to load, just store req in our state struct */
577     assert(s->req == NULL);
578     scsi_req_ref(req);
579     s->req = req;
580     return NULL;
581 }
582 
583 static const struct SCSIBusInfo usb_msd_scsi_info_storage = {
584     .tcq = false,
585     .max_target = 0,
586     .max_lun = 0,
587 
588     .transfer_data = usb_msd_transfer_data,
589     .complete = usb_msd_command_complete,
590     .cancel = usb_msd_request_cancelled,
591     .load_request = usb_msd_load_request,
592 };
593 
594 static const struct SCSIBusInfo usb_msd_scsi_info_bot = {
595     .tcq = false,
596     .max_target = 0,
597     .max_lun = 15,
598 
599     .transfer_data = usb_msd_transfer_data,
600     .complete = usb_msd_command_complete,
601     .cancel = usb_msd_request_cancelled,
602     .load_request = usb_msd_load_request,
603 };
604 
605 static void usb_msd_storage_realize(USBDevice *dev, Error **errp)
606 {
607     MSDState *s = USB_STORAGE_DEV(dev);
608     BlockBackend *blk = s->conf.blk;
609     SCSIDevice *scsi_dev;
610 
611     if (!blk) {
612         error_setg(errp, "drive property not set");
613         return;
614     }
615 
616     if (!blkconf_blocksizes(&s->conf, errp)) {
617         return;
618     }
619 
620     if (!blkconf_apply_backend_options(&s->conf, blk_is_read_only(blk), true,
621                                        errp)) {
622         return;
623     }
624 
625     /*
626      * Hack alert: this pretends to be a block device, but it's really
627      * a SCSI bus that can serve only a single device, which it
628      * creates automatically.  But first it needs to detach from its
629      * blockdev, or else scsi_bus_legacy_add_drive() dies when it
630      * attaches again. We also need to take another reference so that
631      * blk_detach_dev() doesn't free blk while we still need it.
632      *
633      * The hack is probably a bad idea.
634      */
635     blk_ref(blk);
636     blk_detach_dev(blk, DEVICE(s));
637     s->conf.blk = NULL;
638 
639     usb_desc_create_serial(dev);
640     usb_desc_init(dev);
641     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
642                  &usb_msd_scsi_info_storage, NULL);
643     scsi_dev = scsi_bus_legacy_add_drive(&s->bus, blk, 0, !!s->removable,
644                                          s->conf.bootindex, s->conf.share_rw,
645                                          s->conf.rerror, s->conf.werror,
646                                          dev->serial,
647                                          errp);
648     blk_unref(blk);
649     if (!scsi_dev) {
650         return;
651     }
652     usb_msd_handle_reset(dev);
653     s->scsi_dev = scsi_dev;
654 }
655 
656 static void usb_msd_bot_realize(USBDevice *dev, Error **errp)
657 {
658     MSDState *s = USB_STORAGE_DEV(dev);
659     DeviceState *d = DEVICE(dev);
660 
661     usb_desc_create_serial(dev);
662     usb_desc_init(dev);
663     if (d->hotplugged) {
664         s->dev.auto_attach = 0;
665     }
666 
667     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
668                  &usb_msd_scsi_info_bot, NULL);
669     usb_msd_handle_reset(dev);
670 }
671 
672 static const VMStateDescription vmstate_usb_msd = {
673     .name = "usb-storage",
674     .version_id = 1,
675     .minimum_version_id = 1,
676     .fields = (VMStateField[]) {
677         VMSTATE_USB_DEVICE(dev, MSDState),
678         VMSTATE_UINT32(mode, MSDState),
679         VMSTATE_UINT32(scsi_len, MSDState),
680         VMSTATE_UINT32(scsi_off, MSDState),
681         VMSTATE_UINT32(data_len, MSDState),
682         VMSTATE_UINT32(csw.sig, MSDState),
683         VMSTATE_UINT32(csw.tag, MSDState),
684         VMSTATE_UINT32(csw.residue, MSDState),
685         VMSTATE_UINT8(csw.status, MSDState),
686         VMSTATE_END_OF_LIST()
687     }
688 };
689 
690 static Property msd_properties[] = {
691     DEFINE_BLOCK_PROPERTIES(MSDState, conf),
692     DEFINE_BLOCK_ERROR_PROPERTIES(MSDState, conf),
693     DEFINE_PROP_BIT("removable", MSDState, removable, 0, false),
694     DEFINE_PROP_END_OF_LIST(),
695 };
696 
697 static void usb_msd_class_initfn_common(ObjectClass *klass, void *data)
698 {
699     DeviceClass *dc = DEVICE_CLASS(klass);
700     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
701 
702     uc->product_desc   = "QEMU USB MSD";
703     uc->usb_desc       = &desc;
704     uc->cancel_packet  = usb_msd_cancel_io;
705     uc->handle_attach  = usb_desc_attach;
706     uc->handle_reset   = usb_msd_handle_reset;
707     uc->handle_control = usb_msd_handle_control;
708     uc->handle_data    = usb_msd_handle_data;
709     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
710     dc->fw_name = "storage";
711     dc->vmsd = &vmstate_usb_msd;
712 }
713 
714 static void usb_msd_class_storage_initfn(ObjectClass *klass, void *data)
715 {
716     DeviceClass *dc = DEVICE_CLASS(klass);
717     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
718 
719     uc->realize = usb_msd_storage_realize;
720     device_class_set_props(dc, msd_properties);
721 }
722 
723 static void usb_msd_get_bootindex(Object *obj, Visitor *v, const char *name,
724                                   void *opaque, Error **errp)
725 {
726     USBDevice *dev = USB_DEVICE(obj);
727     MSDState *s = USB_STORAGE_DEV(dev);
728 
729     visit_type_int32(v, name, &s->conf.bootindex, errp);
730 }
731 
732 static void usb_msd_set_bootindex(Object *obj, Visitor *v, const char *name,
733                                   void *opaque, Error **errp)
734 {
735     USBDevice *dev = USB_DEVICE(obj);
736     MSDState *s = USB_STORAGE_DEV(dev);
737     int32_t boot_index;
738     Error *local_err = NULL;
739 
740     if (!visit_type_int32(v, name, &boot_index, errp)) {
741         return;
742     }
743     /* check whether bootindex is present in fw_boot_order list  */
744     check_boot_index(boot_index, &local_err);
745     if (local_err) {
746         goto out;
747     }
748     /* change bootindex to a new one */
749     s->conf.bootindex = boot_index;
750 
751     if (s->scsi_dev) {
752         object_property_set_int(OBJECT(s->scsi_dev), "bootindex", boot_index,
753                                 &error_abort);
754     }
755 
756 out:
757     error_propagate(errp, local_err);
758 }
759 
760 static const TypeInfo usb_storage_dev_type_info = {
761     .name = TYPE_USB_STORAGE,
762     .parent = TYPE_USB_DEVICE,
763     .instance_size = sizeof(MSDState),
764     .abstract = true,
765     .class_init = usb_msd_class_initfn_common,
766 };
767 
768 static void usb_msd_instance_init(Object *obj)
769 {
770     object_property_add(obj, "bootindex", "int32",
771                         usb_msd_get_bootindex,
772                         usb_msd_set_bootindex, NULL, NULL);
773     object_property_set_int(obj, "bootindex", -1, NULL);
774 }
775 
776 static void usb_msd_class_bot_initfn(ObjectClass *klass, void *data)
777 {
778     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
779 
780     uc->realize = usb_msd_bot_realize;
781     uc->attached_settable = true;
782 }
783 
784 static const TypeInfo msd_info = {
785     .name          = "usb-storage",
786     .parent        = TYPE_USB_STORAGE,
787     .class_init    = usb_msd_class_storage_initfn,
788     .instance_init = usb_msd_instance_init,
789 };
790 
791 static const TypeInfo bot_info = {
792     .name          = "usb-bot",
793     .parent        = TYPE_USB_STORAGE,
794     .class_init    = usb_msd_class_bot_initfn,
795 };
796 
797 static void usb_msd_register_types(void)
798 {
799     type_register_static(&usb_storage_dev_type_info);
800     type_register_static(&msd_info);
801     type_register_static(&bot_info);
802 }
803 
804 type_init(usb_msd_register_types)
805